CISA KEV Additions This Month: What Changed (October 2026 Tracker)

CISA added 18 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog between 1 and 16 October 2026, taking it to 1,748 entries. Every one of the 18 carries a three-day federal remediation deadline, and 15 also require a forensic triage. Fortinet, Ivanti, Palo Alto Networks, Citrix and BeyondTrust appliances lead the list.

Those counts come from CISA's KEV JSON feed, catalog version 2026.10.16, checked on 17 October 2026. The full catalog is browsable on the KEV catalog page. This page is updated as new entries land, and each table carries the catalog version it was built from.

Dupple data: since 17 July 2026, Cyberpresso has published 50 posts that cite the KEV catalog, and those posts name 66 of the 264 CVEs CISA added in 2026, counted from our own archive on 17 October 2026. Four of this month's 18 additions already have a Cyberpresso write-up, linked in the table below.

October 2026 at a glance

The short read: October is running slower than September, but every entry sits on the shortest clock CISA uses. A security team that triages KEV weekly is already too slow for the federal standard, and private-sector attackers do not wait for federal deadlines either.

Every CVE added to KEV in October 2026

Source: CISA KEV feed, catalog version 2026.10.16, read 17 October 2026. Weakness labels paraphrase the CWE CISA attaches to each entry.

What changed this month

The edge is still the target

Eleven of the 18 additions sit on devices or services that face the internet by design: FortiMail, Fortinet's management products, NetScaler, Ivanti Connect Secure, PAN-OS, Cisco Secure Email Gateway, BeyondTrust Remote Support, BIND, ProFTPD and Zammad's help desk. These are the boxes an attacker can reach without phishing anyone first, which is why they keep showing up.

The practical consequence is simple to state and hard to execute. If your team owns any of those products, the patch window is the time between CISA's alert and the next mass scan, not the three days on the federal clock. Our NetScaler zero-day report covers the earlier Citrix flaws exploited this year.

Old bugs came back on 8 October

On a single day, CISA added five CVEs whose IDs date from 2015 to 2023: BIND (CVE-2015-5477), ProFTPD (CVE-2015-3306), Apache Struts (CVE-2016-3081), ONLYOFFICE Docs (CVE-2021-3199) and Strapi (CVE-2023-22894). A catalog entry means CISA has evidence of exploitation, so these are not history lessons.

Who should care: anyone running forgotten infrastructure, such as an old FTP server in a branch office, a BIND resolver nobody has touched, or a Strapi admin panel left from a marketing project. Asset inventory catches these; patch dashboards that only track supported versions often miss them. The fix is rarely a patch at all: for software this old, the realistic options are an upgrade to a supported release, a firewall rule that takes the service off the internet, or switching it off.

Every deadline is now three days

All 18 October entries carry a due date three days after the date added. Under BOD 22-01, the norm was 21 days: every entry added in October 2025 had a 21-day deadline. No KEV entry has carried a 21-day deadline since March 2026.

The rule behind the change is BOD 26-04, issued on 10 June 2026, which revoked both BOD 22-01 and BOD 19-02 and ties the remediation timeline to exposure and risk. The first catalog entry citing it was added on 11 June 2026, and every entry since July has cited it.

Forensic triage is now the default

Fifteen of this month's 18 entries say "Yes" in the forensic triage field. BOD 26-04 says that label means agencies must fix the flaw within the three-day timeline and also check whether the asset was already compromised. The field first showed "Yes" on an entry added on 25 June 2026, and the share has climbed since.

For a private-sector team, the lesson carries over. Patching an exploited edge device without looking for a web shell or a new admin account fixes tomorrow's risk and ignores yesterday's. Our incident response platforms guide covers the tools for that check.

How October compares with earlier months

Source: CISA KEV feed, catalog version 2026.10.16. Counts use the date each entry was added.

September's 43 additions were the most of any month in 2026, and the 264 entries added from 1 January to 16 October 2026 already exceed the 245 CISA added in all of 2025. Over the same window last year the catalog grew by 202 entries, so the 2026 pace is about 31% higher.

Ransomware flags lag. CISA marks 27 of the 2026 additions as "Known" for use in ransomware campaigns, but none of the September or October entries carries that label yet. The field records what CISA knows when it publishes, so an "Unknown" today is not a "No".

What to do with this month's list

Treat the table as a work queue ordered by exposure rather than by CVSS score, because an exploited flaw on an internet-facing box outranks a higher score on an internal server.

1. Internet-facing first. Check FortiMail, Fortinet management products, NetScaler, Ivanti Connect Secure, PAN-OS, Cisco Secure Email Gateway and BeyondTrust Remote Support. All of them except NetScaler carry a forensic triage flag this month.
2. Hunt, then patch, on edge devices. For each exposed system, look for new local accounts, unexpected configuration changes and web shells before closing the ticket.
3. Search for the old five. Query your inventory for BIND, ProFTPD, Struts, ONLYOFFICE Docs and Strapi, including shadow IT. An attack surface management tool finds the internet-facing ones you forgot.
4. Windows and Atlassian on the normal fast track. CVE-2026-96951 and the Atlassian entry need patch rollout within days, not the monthly cycle.
5. Record the date. Note when each item was fixed, so the next audit or insurance renewal can see how long each KEV entry stayed open on your network.

A scanner run against the full asset list makes step 3 much faster; our vulnerability scanner rankings compare the options and their prices.

How we track KEV additions

We read CISA's machine-readable KEV feed, not press coverage, and count entries by their "dateAdded" field. Deadlines are the "dueDate" minus "dateAdded", in calendar days. Forensic triage and ransomware values are copied as CISA publishes them. Each refresh notes the catalog version so any number on this page can be checked against the same file.

Dupple runs no test lab and has not verified exploitation itself; every exploitation claim here is CISA's. Earlier single-batch reports remain on the blog, such as the August NetScaler and SQL Server batch and the SharePoint KEV entry with web shells.

FAQ

How many vulnerabilities did CISA add to KEV this month?

CISA added 18 vulnerabilities to the Known Exploited Vulnerabilities catalog between 1 and 16 October 2026, according to its KEV feed (catalog version 2026.10.16). That brings the catalog to 1,748 entries. September 2026 had 43 additions, the highest monthly count of the year.

What is the CISA KEV catalog?

The KEV catalog is CISA's list of vulnerabilities with evidence of active exploitation in the wild. Federal civilian agencies must remediate listed flaws by the due date CISA sets, and many private companies use the list to prioritize patching. CISA created it in 2021 under BOD 22-01.

What is the KEV deadline under BOD 26-04?

BOD 26-04, issued on 10 June 2026, replaced BOD 22-01 and sets remediation timelines by risk and exposure. In the KEV feed, every October 2026 entry carries a three-day deadline, and since June 2026 entries have carried either 3 or 14 days. Entries marked for forensic triage also require agencies to check whether the asset was compromised.

Which vendors appear most in KEV in 2026?

Microsoft leads 2026 additions with 40 CVEs, followed by Cisco with 19, and Fortinet and Apple with 9 each, counted from the KEV feed through 16 October 2026. In October alone, Fortinet, Ahsay and Zammad each had two entries.

Does KEV say which vulnerabilities ransomware gangs use?

Yes, each entry has a field marked "Known" or "Unknown" for ransomware campaign use. CISA marks 27 of the 264 entries added in 2026 as "Known", and none of the September or October 2026 entries is flagged yet. "Unknown" means CISA has not confirmed ransomware use, not that it is absent.

Do private companies have to follow KEV deadlines?

No. BOD 26-04 binds federal civilian executive branch agencies. Private companies are not legally bound by it, but the catalog is the clearest public signal of what attackers exploit, so many security teams use the federal deadline as an internal target.

Cite this: Cyberpresso, "CISA KEV Additions This Month: What Changed (October 2026 Tracker)", October 2026.

Cyberpresso tracks every KEV batch and the exploits behind it in one daily brief for security teams. Join at cyberpresso.com.

Some offers on this page may be paid placements or contain affiliate links.